Quick answers
- Is CVE-2026-39489 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39489 being exploited in the wild.
- How severe is CVE-2026-39489?
- Medium severity, with a CVSS score of 4.4, published 15 June 2026.
- Which products and versions are affected?
- WP Chill Download Monitor <= 5.1.9.
- Is there a fix for CVE-2026-39489?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-39489 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-39489?
- Check whether you run WP Chill Download Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability (CWE-22) exists in the Download Monitor plugin for WordPress in versions up to and including 5.1.9. The flaw allows an authenticated attacker with Author-level permissions to bypass intended directory restrictions and download arbitrary files from the underlying server. The vulnerability stems from improper limitation of a pathname to a restricted directory. While the attack requires high privileges (Author role) and has high complexity, a successful exploit results in a high confidentiality impact. The issue is resolved in version 5.1.10.
Affected products
- WP Chill Download Monitor <= 5.1.9
Timeline
- 2026-02-23: other: Reported by researcher daroo
- 2026-04-20: advisory: Patchstack advisory published
- 2026-06-15: disclosed: NVD publication date